Nextcloud Server 31.0.14 → 35.0.2
36 releases · 20 breaking changes · 95 security fixes · 0 advisories fixed
95security20breaking6deprecated252feature372fix
Breaking changes
- breaking Remove usage of static vars or properties (server#59002) in 35.0.0
- breaking Revert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773) in 35.0.0
- breaking [master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271) in 35.0.0
- breaking Chore!: drop jQuery UI and jQuery (server#57648) in 34.0.0
- breaking Remove external shares from share list (server#58204) in 34.0.0
- breaking Remove leftover useless path assignements in View (server#58835) in 34.0.0
- breaking Remove static vars, first batch (server#59159) in 34.0.0
- breaking Remove long-time deprecated methods (server#59544) in 34.0.0
- breaking Chore!(core): remove deprecated Handlebars globals (server#59748) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60244) in 34.0.0
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8311) in 34.0.0
- breaking Remove unneeded sort when listing mail/federated shares (server#60356) in 33.0.4
- breaking Debt(files): Remove regular stats request (server#56822) in 33.0.3
- breaking Remove external shares from share list (server#58717) in 33.0.1
- breaking Remove unneeded max-height from text-menubar which caused a bug (text#8351) in 33.0.1
- breaking Chore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718) in 33.0.0
- breaking Remove stable30 from dependabot (server#56018) in 33.0.0
- breaking Debt(files): Remove regular stats request (server#56792) in 33.0.0
- breaking Enhancement(files): remove redundant success toast on file rename (server#57168) in 33.0.0
- breaking Refactor!: migrate files sidebar to Node API (server#57277) in 33.0.0
Security changes
- security [master] fix(security): Update code signing revocation list (server#60705) in 35.0.0
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#60992) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61088) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61227) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61268) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61423) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#61900) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62019) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62166) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#62256) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62632) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#62857) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63142) in 35.0.0
- security [master] fix(security): Update CA certificate bundle (server#63231) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63335) in 35.0.0
- security [master] fix(security): Update code signing revocation list (server#63485) in 35.0.0
- security Fix(security): Update code signing revocation list (server#64051) in 35.0.0
- security Master] fix(security): Update code signing revocation list (server#64464) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#64721) in 34.0.5
- security Master] fix(security): Update code signing revocation list (server#63358) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63364) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63370) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#63521) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#64097) in 34.0.4
- security Master] fix(security): Update code signing revocation list (server#62652) in 34.0.3
- security Master] fix(security): Update code signing revocation list (server#62040) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62046) in 34.0.2
- security Master] fix(security): Update code signing revocation list (server#62184) in 34.0.2
- security Master] fix(security): Update CA certificate bundle (server#62437) in 34.0.2
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61133) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61239) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61283) in 34.0.1
- security Master] fix(security): Update code signing revocation list (server#61429) in 34.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58869) in 34.0.0
- security Fix(security): Update Expires time (server#60397) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#61001) in 34.0.0
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476) in 34.0.0
- security Master] fix(security): Update code signing revocation list (server#64465) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#64720) in 33.0.10
- security Master] fix(security): Update code signing revocation list (server#63357) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63363) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63369) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#63520) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#64098) in 33.0.9
- security Master] fix(security): Update code signing revocation list (server#62653) in 33.0.8
- security Master] fix(security): Update code signing revocation list (server#62041) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62047) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#62185) in 33.0.7
- security Master] fix(security): Update CA certificate bundle (server#62436) in 33.0.7
- security Master] fix(security): Update code signing revocation list (server#61002) in 33.0.6
- security Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61134) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61238) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61284) in 33.0.6
- security Master] fix(security): Update code signing revocation list (server#61430) in 33.0.6
- security Fix(security): Update Expires time (server#60396) in 33.0.4
- security Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580) in 33.0.4
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 33.0.3
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 33.0.3
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 33.0.3
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 33.0.3
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 33.0.3
- security Fix(security): Update Expires time (server#54868) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#54982) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55051) in 33.0.3
- security Fix(security): Update code signing revocation list (server#55445) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56209) in 33.0.3
- security Fix(security): Update code signing revocation list (server#56365) in 33.0.3
- security Fix(security): Update CA certificate bundle (server#56812) in 33.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 33.0.1
- security Fix(SecurityMiddleware): return header to distinguish error type (server#58880) in 33.0.1
- security [master] fix(security): Update CA certificate bundle (server#54992) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55056) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#55446) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56211) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#56363) in 33.0.0
- security [master] fix(security): Update CA certificate bundle (server#56811) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57031) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57262) in 33.0.0
- security [master] fix(security): Update code signing revocation list (server#57380) in 33.0.0
- security Fix(security): Update Expires time (server#57688) in 33.0.0
- security Fix(security): Update code signing revocation list (server#57948) in 33.0.0
- security Fixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL… in 32.0.9
- security Fixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments… in 32.0.9
- security Fixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ… in 32.0.9
- security Fixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at… in 32.0.9
- security Fixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu… in 32.0.9
- security Fixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf… in 32.0.4
- security Fixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica… in 32.0.3
- security Fixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont… in 32.0.3
- security Fixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the… in 32.0.2
- security Fixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2… in 32.0.1
- security Fixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont… in 32.0.1
Deprecations
- deprecated Deprecate long, non-lazy app config and user config (server#65012) in 35.0.2
- deprecated Fix deprecations in tests (server#61140) in 35.0.0
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1264) in 34.0.0
- deprecated Fix – Replaced deprecated QueryBuilder `execute()` (privacy#1268) in 33.0.1
- deprecated Port away from deprecated Doctrine APIs (server#55674) in 33.0.0
- deprecated Cleanup unused code and deprecated imports (text#7752) in 33.0.0
Every release in between
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64322)
fixFix(files_sharing): name the parent folder in inherited unshare actions (server#64349)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64482)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64485)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64609)
fixFix: forbid newline characters in filenames (server#64613)
fixFix: correct cast ttl to int in KeyValueCache (server#64615)
featureAdd API to generate system report section (server#64631)
fixFix(auth): keep remember-me cookies pointing at a live session token (server#64649)
fixFix: never block simple renames in SharesPlugin (server#64681)
featureFeat(upgrade): localize app names if available on upgrade page (server#64693)
fixFix(files): keep deleting live photo peers after a missing one (server#64699)
fixFix(files_sharing): render share suggestion avatar when provided (server#64704)
fixFix(setupcheck): Print verbose info to allow finding out memory issues (server#64751)
featureFeat: add additional metadata to node webhooks (server#64847)
fixFix(EmojiHelper): exclude non-latin letters from EmojiHelper (server#64866)
featureFeat: make comment events webhook compatible (server#64868)
fixFix(Sharing): Fix recipient IDs on 32-bits (server#64870)
fixFix(files_external): preserve boolean mount options (server#64879)
fixFix(SchemaChecker): don’t block on unexpected-table finding (server#64891)
fixFix(adminaudit): Allow named placeholders via CriticalActionPerformedEvent (server#64895)
fixFix(cache): Check if $entry[‘fileid’] exists (server#64902)
fixFix(user_ldap): show %uid instead of %%uid in the login filter hint (server#64913)
fixFix: Make all app versions stable (server#64915)
featurePerf(files): Only match search results against caches of their storage (server#64916)
featureFeat(files-search): Add push down negation optimizer (server#64923)
featureFeat: Add code integrity background job (server#64974)
deprecatedDeprecate long, non-lazy app config and user config (server#65012)
featurePerf: Optimize deleting the list of invalid shares (server#65137)
featureFeat: Add IAccountScopedSearchProvider (server#65313)
featureFeat: Build js after merge (activity#2998)
featurePerf: Cache public share (activity#3004)
featurePerf: Use startActivityTransaction in a few more places (activity#3016)
featureFeat: Build js after merge (circles#2978)
featureFeat(workflow): Add fixup block (circles#2989)
featureFeat: Bump pdf js (files_pdfviewer#1567)
featureFeat: expose Nextcloud AIO version in info API (serverinfo#1189)
featurePerf: get all markdown files in one SQL query (text#9291)
featurePerf(session): fetch document only once in SessionMiddleware (text#9295)
featureFeat(edit): collaborate in other apps(deck) (text#9325)
+102 more items in the release notesfixFix(Sharing): Prevent truncation of node IDs (server#64140)
fixFix(trashbin): properly unpause trashbin on error (server#64177)
fixFix: update left padding of public shares (server#64213)
fixFix: update shared resource calendar icon for different theme (server#64288)
fixFix(i18n): Remove ellipsis from search strings (server#64323)
fixFix: preserve link shares on ownership transfer (server#64332)
featureAllow quota write streams with unknown free space (server#64341)
fixFix: remove nested items from favorites view on unfavorite (server#64344)
fixFix(Sharing): Hide non-matching recipients instead of only their secrets (server#64353)
fixFix(encryption): cap and invalidate key-cache (server#64356)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64357)
fixFix(files_external): show that an unrestricted storage applies to all (server#64362)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64367)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64372)
fixFix: show custom permissions when share is removed from edit bundle (server#64375)
fixFix: logs can leak sensitive information.. (server#64386)
fixFix: skip copying skeleton if the user has 0 quota (server#64396)
fixFix(files): bring back ownership transfer of all files (server#64407)
fixFix: use correct mimetype for theming logo (server#64410)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64416)
fixFix: scope group share child permission updates to usergroup (server#64417)
fixFix(sharing): Hide Allow download and sync option for federated (server#64421)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64425)
fixFix(previews): set Content-Type header for Imaginary requests (server#64431)
featureImplement recommended recipient api for unified sharing (server#64433)
fixFix(CalDAV): extract data from occurance exemptions (server#64438)
featureAdd files:list command and fix auto completion (server#64439)
fixFix(config): Don’t print sensitive config when setting them (server#64442)
featureFeat: Add more debug output when checkTokenCredentials fails (server#64472)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64477)
fixFix(filecache): announce every removed entry so metadata is cleaned up (server#64498)
fixFix(files): validate dropped filenames before upload (server#64502)
fixFix: remove dead hook listener and replace with event listener (server#64509)
fixFix(CalDAV): set significant change flag properly (server#64520)
featureFeat(files): bring back the Sidebar API (server#64581)
featurePerf: Improve token exchange (server#64597)
featureFeat: let apps define the actor of an activity via the activity manager (activity#2930)
featureAdd a vitest harness for the front-end (files_pdfviewer#1564)
featureFeat(api): Allow to filter the API by app and object (notifications#3389)
featureFeat(menu): add Mermaid diagram entry to Blocks menu (text#9204)
+34 more items in the release notesfeatureAdd rel attribute for fediverse link to make verification possible. (server#43364)
featureFeat(deps): Upgrade phpseclib to v3 (server#48183)
featureFeat(occ): Better handling of disabled or unreacheable App store (server#49697)
featureFeat: Run setup checks by category or class (server#49978)
featureAdded parameter to disable web UI integration with local client (server#54191)
featureFeat: OCS Calendar Import (server#55178)
featureFeat(theming): add option for reduce animation (server#55406)
featureFeat(entity): Provide a new API for entities (server#56199)
featureAdded a exclude disabled option to last seen (server#57081)
featureFeat (2fa): Add IStatelessProvider interface (server#57216)
featureImplement token exchange from OCM (server#57234)
featureMove invite-accepted capability and implementation to contacts app. (server#57853)
featureFeat: delay fetching the display name of a share recipient untill we need it (server#58335)
featureFeat: frankenphp (server#58541)
featureFeat(lookup): search for local account only via lookupserver (server#58567)
breakingRemove usage of static vars or properties (server#59002)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#59271)
featureFeat(files_versions): allow to block version creation using WFE (server#59610)
featureFeat: allow setting custom login-name for occ generated app password (server#59680)
security[master] fix(security): Update code signing revocation list (server#60705)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#60735)
security[master] fix(security): Update code signing revocation list (server#60992)
security[master] fix(security): Update code signing revocation list (server#61088)
deprecatedFix deprecations in tests (server#61140)
security[master] fix(security): Update code signing revocation list (server#61227)
security[master] fix(security): Update code signing revocation list (server#61268)
security[master] fix(security): Update code signing revocation list (server#61423)
security[master] fix(security): Update code signing revocation list (server#61900)
security[master] fix(security): Update code signing revocation list (server#62019)
security[master] fix(security): Update code signing revocation list (server#62166)
security[master] fix(security): Update CA certificate bundle (server#62256)
security[master] fix(security): Update code signing revocation list (server#62632)
security[master] fix(security): Update code signing revocation list (server#62857)
security[master] fix(security): Update code signing revocation list (server#63142)
security[master] fix(security): Update CA certificate bundle (server#63231)
security[master] fix(security): Update code signing revocation list (server#63335)
security[master] fix(security): Update code signing revocation list (server#63485)
breakingRevert “fix(installer): re-enable version-incompatible apps after appstore update” (server#63773)
securityFix(security): Update code signing revocation list (server#64051)
breaking[master] fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3271)
+2377 more items in the release notesfeatureFeat(search): Subdue header search input placeholder (server#60833)
fixFix(files_sharing): Use share id in file actions (server#62403)
fixFix(dashboard): update scrollbar contrast on background (server#62630)
fixFix(encryption): bind personal private key password inputs (server#62672)
fixFix: allow Enter on public share Download link (server#62770)
fixFix: multiple file selection on tab navigation (server#63214)
fixFix: Combined Calendar and Contacts Import (server#63334)
fixFix: fail uploads when uri does not match session/share token (server#63960)
fixFix(files_external): map display names for groups (server#64010)
fixFix(sharing): Hide Allow download and sync option for federated (server#64013)
fixFix(tags): broken tag deletion on user delete (server#64089)
fixFix(metadata): bind chunked file ids in dropMetadataForFiles (server#64092)
fixFix: protect share accept endpoint with CSRF token (server#64107)
fixFix: remove wrongly used system address book flag (server#64131)
fixFix(files_sharing): normalize share target on parent folder rename (server#64143)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64146)
fixFix: update left padding of public shares (server#64212)
fixFix(ci): Pin 32-bit (server#64304)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64321)
fixFix: preserve link shares on ownership transfer (server#64330)
featureAllow quota write streams with unknown free space (server#64342)
fixFix: remove nested items from favorites view on unfavorite (server#64345)
fixFix(encryption): cap and invalidate key-cache (server#64355)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64359)
fixFix(files_external): show that an unrestricted storage applies to all (server#64361)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64368)
fixFix: improve form validation feedback for login, account creation, and sharing (server#64373)
fixFix: show custom permissions when share is removed from edit bundle (server#64376)
fixFix: logs can leak sensitive information.. (server#64385)
fixFix: skip copying skeleton if the user has 0 quota (server#64397)
fixFix: use correct mimetype for theming logo (server#64409)
securityMaster] fix(security): Update code signing revocation list (server#64464)
featurePerf(setupchecks): Don’t load all tasks to calculate stats (server#64610)
featureAdd API to generate system report section (server#64632)
securityMaster] fix(security): Update code signing revocation list (server#64721)
featureFeat: add additional metadata to node webhooks (server#64846)
featurePerf(files): Only match search results against caches of their storage (server#64917)
featureFeat: Add code integrity background job (server#64973)
featureFeat(workflow): Add fixup block (circles#2988)
featurePerf(session): fetch document only once in SessionMiddleware (text#9296)
+106 more items in the release notesfixFix(theming): mark background button text as English (server#62252)
fixFix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)
fixFix: make unified filter chip accessible (server#63224)
fixFix(preview): delete version metadata by preview ID (server#63290)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)
fixFix(group): Set the display name on every backends that supports it (server#63321)
fixFix(jobs): don’t overwrite the –stop_after baseline in background-job:worker (server#63328)
fixFix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)
fixFix(preview): order previews by ID during pagination (server#63345)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)
securityMaster] fix(security): Update code signing revocation list (server#63358)
securityMaster] fix(security): Update code signing revocation list (server#63364)
securityMaster] fix(security): Update code signing revocation list (server#63370)
fixFix: Creating shares with multiple mount permissions (server#63372)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63379)
fixFix: Public link with multiple mounts (server#63384)
featureFeat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)
fixFix(preview): keep the local file when losing the insert race (server#63390)
fixFix(files_sharing): Use share password policy for password generation (server#63397)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)
featureFeat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)
fixFix(files_reminder): passed reminder handling (server#63425)
fixFix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63456)
securityMaster] fix(security): Update code signing revocation list (server#63521)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63523)
fixFix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)
fixFix(dav): Handle correctly not found while streaming output (server#63533)
fixFix(provisioning_api): let sub-admins change group memberships (server#63534)
fixFix(files): hide download action in link shares for newly created folders (server#63552)
featureFeat(updater): clear app_install_overwrite on major upgrades (server#63633)
fixFix(appconfig): make type-conflict error self-explanatory (server#63643)
fixFix(dav): scope contact photo export to local address books (server#63645)
fixFix cancelling the customization of a share (server#63658)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63668)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63678)
securityMaster] fix(security): Update code signing revocation list (server#64097)
featureAdd a vitest harness for the front-end (files_pdfviewer#1565)
+67 more items in the release notesfeaturePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62223)
fixFix: Output shape validation will delete keys when there is a list of files (server#62237)
fixFix(jobs): resolve portability issues with background job cleanup (server#62279)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62281)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62337)
fixFix(preview): Handle unique constraints violation exception (server#62363)
fixFix(files_version): mtime confusion on milliseconds (server#62372)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62418)
fixFix(SetupChecks): Link to task processing worker docs (server#62443)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62451)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62457)
fixFix: harden object store against copying a file to itself (server#62461)
fixFix: Use PHP_AUTH_PW for strict password confirmation (server#62537)
featurePerf: Use hash map to check if path was already checked (server#62588)
fixFix(TaskProcessing): Claim tasks atomically in both SynchronousBackgr… (server#62608)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62611)
fixFix(unified-search): catch errors in response (server#62616)
securityMaster] fix(security): Update code signing revocation list (server#62652)
fixFix(search): Add end date for last 7 and last 30 days (server#62685)
fixFix(caldav): Expand recurring events for principal calendar search (server#62693)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62702)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62714)
fixFix(imip): add context to imip log messages (server#62723)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62733)
fixFix(jobs): compute memory usage after clean-up (server#62768)
fixFix(metadata): bind chunked file ids (server#62771)
featurePerf(user-display-name): Check memory cache before trying redis (server#62778)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62780)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62784)
fixFix(encryption): handle decryption exception with outdated passwords (server#62788)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62792)
fixFix(share): Avoid crash when share owner is not found (server#62798)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62908)
featureFeat: Allow to check user existence outside specific user backends (server#62917)
featureFeat(lookup): search for local account only via lookupserver (server#62934)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62949)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63113)
featurePerf(files): compute move/rename activity settings once (activity#2794)
featureFeat: adding an option to exclude users from the acitivity log (activity#2808)
featurePerf(push): Send push notifications async to proxies (notifications#3246)
+83 more items in the release notesfixFix(cypress): disable unsupported-browser redirect in test container (server#60807)
featureFeat(UserManager): Add getters for avatar URLs (server#60811)
fixFix(core): public share download icon color and theme filter scope (server#61211)
fixFix: use card interface instead of object (server#61252)
fixFix: properly mark CleanupShareTarget as expensive (server#61498)
fixFix: update cached mounts when moving share in repair step (server#61500)
fixFix(files_trashbin): create folder if missing when expiring trash (server#61523)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61528)
fixFix: stop calling DI container in SharedStorage (server#61529)
fixFix(preview): First cleanup from filecache and then from preview table (server#61531)
featurePerf(View): don’t sort twice the same array (server#61535)
featurePerf: block more properties from using the custom properties backend (server#61540)
fixFix(settings): correct heading order in account management sidebar (server#61546)
fixFix: Make the IProvideUserSecretBackend usable (server#61550)
fixFix: track time spent in recursive markOrRun calls (server#61553)
featurePerf(log): normalize log data only when logging (server#61557)
featurePerf: avoid DIing IRootFolder at every shared storage init (server#61558)
featurePerf: Only sort wrappers when adding them (server#61700)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61852)
featureFeat(OCP): Add Interaction API (server#61867)
featureFeat: Disable callable serialization in sabre/xml (server#61923)
featureFeat: Fetch groups in batch in getUserGroups (server#61936)
featureFeat(login): clean remember me tokens (server#61972)
securityMaster] fix(security): Update code signing revocation list (server#62040)
securityMaster] fix(security): Update code signing revocation list (server#62046)
featurePerf(carddav): reduce disk usage of photocache (server#62054)
featurePerf(workflow): Implement result cache for IP checks (server#62057)
featureFeat: KV cache based on predis (server#62070)
featureFeat(share): add public share-review API under OCP\Share\ShareReview (server#62132)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62180)
securityMaster] fix(security): Update code signing revocation list (server#62184)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62197)
featurePerf(dav): Stream PROPFIND output (server#62224)
securityMaster] fix(security): Update CA certificate bundle (server#62437)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2513)
featureFeat: add predis as a dependency for Valkey cluster support (3rdparty#2518)
featureFeat: make amount of items sent on email configurable via occ (activity#2708)
featureFeat: add release relay gh workflow (app_api#924)
featureEnh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)
featureFeat: Add login output when password policy fails (password_policy#966)
+351 more items in the release notesfixFix: folder tree selection after any action in main content (server#60478)
fixFix(files): show proper information when a move will override the target (server#60963)
featurePerf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
fixFix(theming): read cachebuster as int in manifest endpoint (server#61010)
fixFix(dav): finalize upload metadata before post-write hooks (server#61072)
fixFix(comments): load comments styles when the comments app is loaded (server#61076)
fixFix(dav): properly handle files metadata (server#61078)
fixFix(settings): Fix appstore icon color in settings menu (server#61093)
fixFix(comments): Use capped memory cache for comments (server#61097)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
fixFix: Correctly detect appid for dist css files (server#61113)
fixFix: use correct permissions mask for non-home storage public links (server#61118)
fixFix(settings): Show loading spinner while searching accounts (server#61122)
securityMaster] fix(security): Update code signing revocation list (server#61133)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
fixFix(core): keep app menu settings icon legible on light backgrounds (server#61161)
fixFix(previews): ffprobe hangs (server#61182)
fixFix(files_versions): guard null path in event listeners (server#61189)
fixFix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
fixFix(appstore): bring back “update all” button (server#61212)
fixFix(settings): clear NcAppNavigation toggle overhang (server#61234)
securityMaster] fix(security): Update code signing revocation list (server#61239)
featureFeat(settings): Require 8.3 for 35 (server#61241)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
fixFix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
securityMaster] fix(security): Update code signing revocation list (server#61283)
fixFix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
fixFix(theming): preserve uploaded favicon and touch icon (server#61302)
fixFix: Use token expiration for ephemeral sessions (server#61305)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61309)
fixFix(user_ldap): Escape filter part when searching for group members (server#61325)
featureAdd OCM Notification Received Event (server#61337)
fixFix: trim duplicate search results for external share (server#61340)
fixFix: Do not set last-password-confirm for apptoken sessions (server#61342)
fixFix(team-manager): ensure team resources are only retrived for members (server#61351)
securityMaster] fix(security): Update code signing revocation list (server#61429)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
featurePerf: Avoir calling Server::get for each share mounts (files_lock#1123)
+50 more items in the release notesfeatureFeat(filecache): Scale DB query created when deleting file from filecache (server#54277)
featureFeat: add oc-ownerid and oc-permissions headers on PUT DAV requests (server#54542)
featureAdd some missing attributes (server#55474)
featureFeat(preview): Expire previews (server#55632)
featureFeat(preview): On demand preview migration (server#55649)
featureAdd configs for strict PHP checks (server#56522)
featureFeat(app): allow removing installed-but-disabled apps; improve help & logging (server#56720)
featureFeat: improve calendar migrator (server#57112)
featureFeat: perform share mount validation on share instead of on mount (server#57295)
featureFeat(http-client): add option to add instance URL to HTTP client user-agent (server#57376)
featureFeat(mimetypes): Add mimetype aliases/mapping/names for .toml and .ovpn (server#57480)
featureFeat(external-storage): Implement IPartialMountPoint (server#57497)
featureAdd InstallationCompletedEvent for post-installation actions (server#57522)
featureFeat(user_picker): Move the profile picker to server (server#57539)
featureFeat: Add office switcher with feature comparison (server#57555)
featurePerf(normalization): Optimize path normalization (server#57570)
featureFeat(objectstore): Add AWS SSE-KMS encryption support for S3 storage (server#57623)
breakingChore!: drop jQuery UI and jQuery (server#57648)
featureFeat(files): render file list filters in top bar and allow to collapse into overflow menu (server#57664)
featureFeat: allow to filter contacts by team (server#57676)
featureFeat: Add twofactor applications to most of the presets (server#57737)
featureFeat(sharing): Make share permission in bundled edit configurable (server#57741)
featureFeat(openmetrics): add log level (server#57759)
featureFeat(contacts): support federated users/groups search when adding team members (server#57782)
featureFeat(flake): Add reuse cli (server#57800)
featureFeat: optimize user mount cache (server#57815)
featureFeat(OCP): Expose setup manager to OCP (server#57826)
featureFeat: Add SetupCheck to warn about missing second factor provider (server#57854)
breakingRemove external shares from share list (server#58204)
breakingRemove leftover useless path assignements in View (server#58835)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58869)
breakingRemove static vars, first batch (server#59159)
breakingRemove long-time deprecated methods (server#59544)
breakingChore!(core): remove deprecated Handlebars globals (server#59748)
breakingRemove unneeded sort when listing mail/federated shares (server#60244)
securityFix(security): Update Expires time (server#60397)
securityMaster] fix(security): Update code signing revocation list (server#61001)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1264)
breakingRemove unneeded max-height from text-menubar which caused a bug (text#8311)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8476)
+949 more items in the release notesfixFix: track time spent in recursive markOrRun calls (server#61552)
fixFix(dashboard): update scrollbar contrast on background (server#62629)
fixFix(encryption): bind personal private key password inputs (server#62671)
fixFix: allow Enter on public share Download link (server#62769)
fixFix: multiple file selection on tab navigation (server#63213)
fixFix(cardDav): Only update user card on actual mapped propreties changes (server#63769)
fixFix: fail uploads when uri does not match session/share token (server#63961)
fixFix(files_external): map display names for groups (server#64009)
fixFix: Unknown cli option (server#64012)
fixFix(sharing): Hide Allow download and sync option for federated (server#64014)
fixFix(tags): broken tag deletion on user delete (server#64088)
fixFix: protect share accept endpoint with CSRF token (server#64108)
fixFix: remove wrongly used system address book flag (server#64130)
fixFix(files_sharing): normalize share target on parent folder rename (server#64142)
fixFix(files_sharing): don’t abort share:list when orphaned shares exist (server#64147)
fixFix: update left padding of public shares (server#64211)
fixFix(ci): Pin 32-bit (server#64305)
fixFix(sharing): Use link_defaultExpDays for default expiration in web UI (server#64320)
fixFix: preserve link shares on ownership transfer (server#64329)
fixFix: remove nested items from favorites view on unfavorite (server#64346)
fixFix(encryption): cap and invalidate key-cache (server#64354)
fixFix(files): Show confirmation dialog on delete hotkey press (server#64358)
fixFix(files_external): show that an unrestricted storage applies to all (server#64360)
fixFix(files_sharing): don’t crash CleanupShareTarget when mount info is missing (server#64366)
fixFix: show custom permissions when share is removed from edit bundle (server#64377)
fixFix: logs can leak sensitive information.. (server#64384)
fixFix(files_sharing): only offer folders in file-request which are shareable (server#64414)
fixFix: scope group share child permission updates to usergroup (server#64418)
fixFix: Send password to owner when password sending fails, regardless of enforcement (server#64423)
fixFix(config): Don’t print sensitive config when setting them (server#64463)
securityMaster] fix(security): Update code signing revocation list (server#64465)
fixFix: keep share visible for share owner when iinitiator is deactivated (server#64475)
fixFix(files_sharing): cap share presets to the permissions the resharer (server#64480)
fixFix(encryption): keep version and size in sync for files not in the cache (server#64483)
fixFix(dav): keep tags on hidden files when setting tag object ids (server#64561)
featureAdd API to generate system report section (server#64633)
securityMaster] fix(security): Update code signing revocation list (server#64720)
featureFeat: add additional metadata to node webhooks (server#64845)
featurePerf(files): Only match search results against caches of their storage (server#64918)
featureFeat(workflow): Add fixup block (circles#2987)
+76 more items in the release notesfixFix(ocm): Move invite-accepted capability and implementati… (server#62460)
fixFix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
featureFeat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
fixFix(CalDAV): iTipBroker message generation and testing (server#63187)
fixFix(preview): delete version metadata by preview ID (server#63289)
fixFix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
fixFix: make unified filter chip accessible (server#63319)
fixFix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
securityMaster] fix(security): Update code signing revocation list (server#63357)
securityMaster] fix(security): Update code signing revocation list (server#63363)
securityMaster] fix(security): Update code signing revocation list (server#63369)
fixFix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
fixFix: allow file request upload when `part_file_in_storage=false` (server#63380)
fixFix: Public link with multiple mounts (server#63383)
fixFix(preview): keep the local file when losing the insert race (server#63391)
fixFix(files_sharing): Use share password policy for password generation (server#63396)
fixFix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
fixFix(files_reminder): passed reminder handling (server#63424)
fixFix(files_external): set usePresignedUrl before first S3 connection (server#63457)
securityMaster] fix(security): Update code signing revocation list (server#63520)
fixFix(preview): execute PreviewMapper::deleteAll() (server#63522)
fixFix(files): hide download action in link shares for newly created folders (server#63553)
fixFix(appconfig): make type-conflict error self-explanatory (server#63642)
fixFix(dav): scope contact photo export to local address books (server#63644)
fixFix cancelling the customization of a share (server#63657)
fixFix(dav): correctly mask public v1 links for non-home storages (server#63667)
fixFix(dav): only derive the write size from a PUT Content-Length (server#63677)
fixFix(settings): Fix AI regex (server#63692)
fixFix: Check that password matches in occ user:auth-tokens:add (server#63696)
fixFix(contactsmenu): restore avatars for non-user contacts (server#63716)
fixFix: Check rememberme cookie previous session id matches uid (server#63720)
fixFix(2fa): Add missing BruteForceProtection attribute (server#63733)
fixFix(core): accept deprecated IANA timezone aliases (server#63757)
fixFix(group): pass previous display name in GroupChangedEvent (server#63780)
fixFix(files_external): guard optional S3 key in storage id computation (server#63818)
fixFix(webauthn): Throw on uid mismatch when updating registration (server#63833)
fixFix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
fixFix: Ensure we don’t get share by empty name (server#63851)
securityMaster] fix(security): Update code signing revocation list (server#64098)
featureAdd a vitest harness for the front-end (files_pdfviewer#1566)
+40 more items in the release notesfixFix(files_sharing): preserve unmasked permissions as scan_permissions (server#62217)
featurePerf: Replace more calls from getUserGroups to getUserGroupIds (server#62222)
fixFix: Output shape validation will delete keys when there is a list of files (server#62238)
fixFix(files_external/SMB): Use ‘null’ explicitly for no workgroup (server#62280)
fixFix(files): properly handle folders without permissions (server#62319)
fixFix(files): preserve encryptedVersion when copying cache entries (server#62338)
fixFix(files_version): mtime confusion on milliseconds (server#62371)
fixFix(files_sharing): Use share id in file actions (server#62402)
fixFix(AmazonS3): pass S3 error messages through to the frontend (server#62419)
fixFix(SetupChecks): Link to task processing worker docs (server#62442)
fixFix: Don’t add empty and broken ExternalShareScanJob on upgrade (server#62452)
fixFix(background-jobs): preserve Snowflake IDs as strings (server#62456)
fixFix: harden object store against copying a file to itself (server#62462)
featurePerf(preview): Optimize retriving all previews from oc_filecache (server#62603)
fixFix(unified-search): catch errors in response (server#62614)
securityMaster] fix(security): Update code signing revocation list (server#62653)
fixFix(search): Add end date for last 7 and last 30 days (server#62684)
fixFix(caldav): Expand recurring events for principal calendar search (server#62692)
fixFix(MemcachedFactory): Enable TCP_NODELAY and adjust default timeouts to be reasonable (server#62703)
fixFix(imip): add context to imip log messages (server#62721)
fixFix(share-api-controller): add sanity check on canAccessShare for circle share types (server#62732)
featurePerf(user-display-name): Check memory cache before trying redis (server#62777)
fixFix(encryption): Correctly report size for zero-byte encrypted files (server#62779)
fixFix(provisioning_api): read newUser.sendEmail as a boolean (server#62785)
fixFix(encryption): handle decryption exception with outdated passwords (server#62787)
fixFix(imip): don’t report success when a calendar cannot process iMip (server#62793)
fixFix(systemTags): setObjectIdsForTag() dispatches once (server#62800)
fixFix: handle sftp private key as password (server#62823)
fixFix: disable direct link if link shares are disabled (server#62831)
fixFix: clear key password after loading key (server#62849)
fixFix(direct editing): cleanup tokens on user deletion (server#62863)
fixFix(dav): properly finalize with MOVE only (server#62875)
fixFix(share): do not re-accept rejected shares (server#62890)
fixFix: throw better error message if a user doesn’t have a key even though it should have (server#62892)
featureFeat: Add setting to bypass password confirmation on a selected ip ranges (server#62907)
featureFeat: Allow to check user existence outside specific user backends (server#62916)
featureFeat(lookup): search for local account only via lookupserver (server#62935)
featureFeat: allow specifying applicable users and groups in the files_external:create command (server#62948)
featureFeat(federation): Add accept/decline mechanism for federated calendars (server#63115)
featureFeat: adding an option to exclude users from the acitivity log (activity#2809)
+62 more items in the release notesfixFix(files_sharing): Drop trailing ‘?’ from public download redirect URL (server#59885)
fixFix(settings): sort app list by app name instead of app objects (server#59992)
fixFix(cypress): disable unsupported-browser redirect in test container (server#60805)
fixFix(core): public share download icon color and theme filter scope (server#61210)
fixFix: update cached mounts when moving share in repair step (server#61499)
fixFix(files_sharing): remove filename’s leading slash on unshare toast (server#61527)
featurePerf: block more properties from using the custom properties backend (server#61541)
fixFix(settings): correct heading order in account management sidebar (server#61547)
fixFix: Make the IProvideUserSecretBackend usable (server#61549)
featurePerf(log): normalize log data only when logging (server#61556)
fixFix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61570)
fixFix(dav): Handle GenericFileException when reading default contact file (server#61595)
fixFix(a11y): label account QR code button (server#61603)
fixFix(files): Open the sidebar for the current folder, not a stale child (server#61605)
fixFix(user_status): stabilise the user_status (server#61619)
fixFix(dav): Load ProfilerPlugin only when profiler is enabled (server#61644)
fixFix(config): Decrypt sensitive appconfigs when requested (server#61661)
fixFix(files_external): ignore deprecated backends (server#61692)
fixFix(files_external): properly apply default mount options (server#61701)
fixFix(settings): in absence form avoid shifting dates to browsers timezone (server#61711)
featurePerf: Only sort wrappers when adding them (server#61718)
featurePerf: Don’t fetch full group object in AuthorizedGroupMapper (server#61851)
featureFeat: Disable callable serialization in sabre/xml (server#61924)
featureFeat: Fetch groups in batch in getUserGroups (server#61935)
featureFeat(login): clean remember me tokens (server#61971)
securityMaster] fix(security): Update code signing revocation list (server#62041)
securityMaster] fix(security): Update code signing revocation list (server#62047)
featurePerf(carddav): reduce disk usage of photocache (server#62053)
featurePerf(workflow): Implement result cache for IP checks (server#62056)
featurePerf: Don’t fetch all the trash items when deleting a single item (server#62179)
securityMaster] fix(security): Update code signing revocation list (server#62185)
featureFeat(files_sharing): schedule external share scan job when accepted (server#62198)
featurePerf(dav): Stream PROPFIND output (server#62225)
securityMaster] fix(security): Update CA certificate bundle (server#62436)
featureFeat: Disable callable serialization in sabre/xml (3rdparty#2512)
featureFeat: make amount of items sent on email configurable via occ (activity#2709)
featurePerf(files): compute move/rename activity settings once (activity#2795)
featureFeat: add release relay gh workflow (app_api#923)
featureFeat: Show request time to the push proxy (notifications#3155)
featureFeat: Add login output when password policy fails (password_policy#967)
+249 more items in the release notesfixDav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
fixFix(files,files_sharing): swallow redirected navigation errors (server#59887)
fixFix(caldav): grant sharee Acls to the delegate (server#60646)
fixFix(http): avoid iconv for header ascii fallback (server#60722)
fixFix(DB): Enforce foreign key constraints in SQLite (server#60792)
fixFix(encryption): recovery keys should be shown when user keys are used (server#60799)
fixFix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
fixFix(files): Chromium-based browsers drag-and-drop (server#60899)
fixFix: actually register listener for updating stored external storage credentials (server#60905)
fixFix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
fixFix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
fixFix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
fixFix(psalm): Update psalm baseline (server#60933)
fixFix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
fixFix(files_sharing): clear the password after saving (server#60951)
fixFix(files): show proper information when a move will override the target (server#60962)
fixFix: access shared and delegated trashbin objects (server#60967)
fixFix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
securityMaster] fix(security): Update code signing revocation list (server#61002)
fixFix(dav): finalize upload metadata before post-write hooks (server#61070)
fixFix(dav): properly handle files metadata (server#61079)
fixFix(comments): Use capped memory cache for comments (server#61096)
securityFix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
fixFix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
fixFix: Correctly detect appid for dist css files (server#61112)
fixFix: use correct permissions mask for non-home storage public links (server#61117)
fixFix(settings): Show loading spinner while searching accounts (server#61121)
securityMaster] fix(security): Update code signing revocation list (server#61134)
featureFeat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
fixFix(previews): ffprobe hangs (server#61183)
fixFix(files_versions): guard null path in event listeners (server#61188)
fixFix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
fixFix(search-query): fix psalm type error (server#61196)
securityMaster] fix(security): Update code signing revocation list (server#61238)
fixFix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
securityMaster] fix(security): Update code signing revocation list (server#61284)
featureFeat(oauth2): Add commands for adding and deleting clients (server#61362)
securityMaster] fix(security): Update code signing revocation list (server#61430)
featurePerf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2637)
featureFeat: Add role-based filtering for circle member queries (circles#2504)
+48 more items in the release notesotherRefactor: move release changelog workflow to releases repo (server#60831)
fixFix: Add missing DI for IAppConfig to Push.php (notifications#3039)
fixFix(folderDescription): always use ‘Readme.md’ as filename (text#8658)
fixFix(headings): skip headings in details in table of contents (text#8660)
otherTest(playwright): add summary job so we can add it to merge rules (text#8663)
fixFix: allow renaming files with just update permissions (server#59241)
fixFix(encryption): limit oprhaned keys scan to one user (server#59808)
fixFix(s3): ignore prefixes with repeating delimiters (server#59829)
fixFix removed address book items not being synced between federated instances (server#59894)
fixFix(files): fix custom client-side error messages on move/copy actions (server#59954)
featureFeat: Better reporting if something is wrong with taskprocessing (server#59991)
fixFix: Harmonize login and passwordless login redirect behavior (server#60007)
fixFix(core): provide valid initial state also on public templates (server#60015)
fixFix(navigation): Fix default app icon (server#60133)
fixFix(files): escape html entities in dav search requests (server#60140)
fixFix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
fixFix(comments): register event listener for typed comment events (server#60149)
fixFix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
fixFix: Dispatch old comment events (server#60168)
fixFix(comments): Add an action to comment notification that dismisses it (server#60175)
fixFix(core): prompt for password once when installing recommended apps (server#60184)
featureFeat(updatenotification): handle files_lock (server#60203)
fixFix(public.scss): increase footer width (server#60208)
fixFix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
fixFix since checker (server#60219)
fixFix(settings): Fix admin delegation for hidden sections (server#60222)
fixFix: Fix permission issue when uploading a chunked file (server#60240)
featureFeat(app-licenses): Add further compatible licenses for apps to use (server#60296)
fixFix(Setup): Ensure instanceid is generated during installation (server#60301)
fixFix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
fixFix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
fixFix(snowflake): fix wrong documentation about serverId (server#60328)
featurePerf(share): Remove useless order by id (server#60345)
breakingRemove unneeded sort when listing mail/federated shares (server#60356)
featurePerf: remove unneeded sort in getFolderContentsById (server#60357)
securityFix(security): Update Expires time (server#60396)
featureFeat(users): Check assertion when enabling user (server#60516)
featureEnh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
featureFeat(openmetrics): export more resilient if exception happens (server#60627)
featureFeat: add search and limit support for team members list (circles#2460)
featureFeat: Remove unnecessary whitespaces (logreader#2027)
featureFeat(push): Optionally use OAEP padding (notifications#2986)
featurePerf(rich_workspace): only add property for parent (text#8498)
featureFeat: add support for wiki-style link and image Markdown syntax (text#8576)
securitySecurity: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
+86 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
featureFeat(migration-attributes): add DataCleansing (server#54861)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54863)
securityFix(security): Update Expires time (server#54868)
featureAdd task processing manager method to get the list of available task type IDs (server#54917)
featureFeat(file_sharing): Provide template creator list in public shares (server#54948)
featureFeat: show object store instance in info:file (server#54961)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#54967)
featurePerf(mounts): avoid array_merge in mounts loop (server#54976)
securityFix(security): Update CA certificate bundle (server#54982)
featureFeat(ZipFolderPlugin): always use the parent folder name as archive name (server#55020)
securityFix(security): Update code signing revocation list (server#55051)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#55060)
featureFeat(files_sharing): provide web components based API for sidebar (server#55174)
featureFeat(db): add SSL/TLS support for PostgreSQL (server#55256)
featureFeat(Unified search): Use existing min search length setting (server#55301)
featureFeat: Mark OC.SystemTags as deprecated (server#55323)
featureAdmin-delegation occ – add output option for show command to support JSON formats (server#55430)
securityFix(security): Update code signing revocation list (server#55445)
featureFeat: add header with user id in response (server#55502)
featureAllow to remove a website in the user profile (server#55523)
featureFeat(test-case): allow to use PHPUnit Group attributes to mark tests requiring database (server#55571)
featureFeat(settings): Introduce TaskProcessingSuccessRate setup check (server#55778)
featureFeat: add new link endpoint when using globalscale (server#55798)
featureFeat(route): globalsiteselector as root url generator (server#55817)
featureFeat: locally cache frequently requested LDAP mapping data (server#55823)
featureAdd font-variant-numeric to selected files list (server#55873)
featureAdd unit tests for AdminDelegation command and AuthorizedGroupService (server#56044)
securityFix(security): Update CA certificate bundle (server#56209)
featureFeat(EphemeralSessions): Introduce lax period (server#56232)
featureFeat(cloud-federation-api): accept folder shares (server#56336)
featureFeat: add occ command to scan and delete orphaned keys (server#56347)
securityFix(security): Update code signing revocation list (server#56365)
featureAdd AI input limits (server#56369)
featureFeat(rate-limit): Allow overwriting the rate limit (server#56382)
featureAdd rememberme checkbox (server#56423)
+732 more items in the release notesotherserver
featureFeat(recent-files): add recent_files_limit config on files settings (server#59216)
other33.0.2 RC0 (server#59259)
fixFix(files_sharing): do not prevent share creation if password is enabled but not supported by the current share type (server#59263)
fixFix(sharing): Don’t redirect when accepting a share failed (server#59305)
other33.0.2 RC1 (server#59306)
other33.0.2 (server#59392)
otheractivity
otherChore(branchoff): Set version on stable33 to a stable one (activity#2480)
otherbruteforcesettings
otherChore(branchoff): Set version on stable33 to a stable one (bruteforcesettings#1032)
otherUpdate nextcloud/ocp dependency (bruteforcesettings#1038)
otherfiles_downloadlimit
otherChore(branchoff): Set version on stable33 to a stable one (files_downloadlimit#756)
otherfiles_pdfviewer
otherChore(branchoff): Set version on stable33 to a stable one (files_pdfviewer#1401)
otherfirstrunwizard
otherChore(branchoff): Set version on stable33 to a stable one (firstrunwizard#2020)
otherpassword_policy
otherChore(branchoff): Set version on stable33 to a stable one (password_policy#914)
otherphotos
otherChore(branchoff): Set version on stable33 to a stable one (photos#3459)
otherprivacy
otherChore(branchoff): Set version on stable33 to a stable one (privacy#1289)
otherrecommendations
otherChore(branchoff): Set version on stable33 to a stable one (recommendations#1004)
otherrelated_resources
otherChore(branchoff): Set version on stable33 to a stable one (related_resources#907)
otherserverinfo
otherChore(branchoff): Set version on stable33 to a stable one (serverinfo#967)
othersurvey_client
otherChore(branchoff): Set version on stable33 to a stable one (survey_client#391)
othersuspicious_login
otherChore(branchoff): Set version on stable33 to a stable one (suspicious_login#1092)
othertext
fixFix(deps): update dependency yjs to ^13.6.30 (text#8394)
otherChore(branchoff): Set version on stable33 to a stable one (text#8407)
othertwofactor_totp
otherChore(branchoff): Set version on stable33 to a stable one (twofactor_totp#1751)
fixFix(deps): align composer-lock and checked-in vendor/ (updater#727)
+3 more items in the release notessecurityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
fixFix(docs): Fix dead documentation link for Windows file names (server#58291)
fixFix(comments): properly handle opening the sidebar when Activity integration is used (server#58294)
fixFix(theming): display error messages on image upload and delete previous image only after validation (server#58323)
fixFix: don’t try to create preview folder if it already exists (server#58328)
fixFix: obey x-nc-scheduling flag on delete (server#58341)
fixFix(sftp): Handle empty port parameter to allow host-defined ports (server#58358)
featureFeat: add upload_time support to file search and recent files (server#58374)
fixFix(files): correctly sort views (server#58375)
fixFix(cache): filter out invalid entries in `OC\Files\Cache\Wrapper\CacheWrapper::getFolderContentsById` (server#58378)
fixFix(setup): add index properties_name_path_user by default on new installs (server#58418)
fixFix(external_storage): hide local storage as an option for users (server#58424)
fixFix(user_status): mount emoji picker outside of dialog (server#58429)
fixFix(perf): use index when deleting old previews (server#58431)
fixFix(Propagator): Skip groupfolders root entries (server#58433)
fixFix/more missing userid cases (server#58440)
fixFix(files_sharing): ensure the server share API errors are shown (server#58441)
fixFix(TransferOwnershipService): Remove groupfolders size (server#58449)
fixFix(Propagator): Also skip groupfolders versions and trash entries (server#58450)
fixFix(View): Handle ICacheEntry returned by FileInfo->getData() (server#58455)
fixFix(files): fix tab navigation from select all checkbox to batch actions (server#58462)
fixFix(files_sharing): make legacy `downloadShare` endpoint compatible with legacy behavior (server#58468)
fixFix(dav): Use an exhaustive list for allowed serialized classes (server#58511)
featureFeat: calendar read and write federation (server#58590)
featurePerf(sharing): Avoid loading all shares from all users when unsharing (server#58658)
featureFeat: set creation_time on file creation and render recently created icon (server#58694)
breakingRemove external shares from share list (server#58717)
featurePerf(preview): bulk process preview regeneration (server#58796)
featureFeat: Add memcache_customprefix (server#58810)
featureFeat(routing): add files_sharing_raw to rootUrlApps (server#58838)
securityFix(SecurityMiddleware): return header to distinguish error type (server#58880)
featureFeat: improve calendar migrator (server#58907)
featureFeat(CalDAV): Add function to get the token of a publicly shared calendar (server#59080)
featureFeat(taskprocessing): add worker command for synchronous task processing (server#59082)
featurePerf: Replace getById call with getFirstNodeById (activity#2388)
featurePerf: add new index to serve a full WHERE clause (activity#2447)
featureFeat: make Docker API version configurable via app config (app_api#798)
featureAvoid cropping logo in About & New slideshow (firstrunwizard#1964)
featureFeat(api): Add context parameter to generate and validate endpoints (password_policy#900)
deprecatedFix – Replaced deprecated QueryBuilder `execute()` (privacy#1268)
+137 more items in the release notesfeatureAdd UserConfigChangedEvent to fire whenever a user config value is changed (server#42039)
featureFeat: Add appconfig to disable fixed userfolder permissions optimization (server#51145)
featureFeat: add an option to filter what paths get checked for updates (server#52442)
featureFeat(CertificateManager): Add option to specify the default certificates bundle path (server#52749)
featureFeat(files_trashbin): Refactor expire background job to support parallel run (server#52825)
featureFeat(previews): allow ffmpeg to connect direct for AWS S3 buckets (server#53634)
featureFeat(login): hide password on form submit (server#53869)
featureFeat(previews): previews for large remote files without full file download (server#53952)
featureFeat(encryption): Add integration tests for occ commands and fix them (server#54316)
featureFeat: locally cache frequently requested LDAP mapping data (server#54429)
featurePerf(s3): Provide direct pre-signed download link (server#54436)
featureAdd INodeByPath to Directory (server#54441)
featureFeat(config): Add common audio and video MIME type aliases (server#54447)
featurePerf(preview): Split preview data to new table (server#54543)
featureFeat(file_sharing): Provide template creator list in public shares (server#54565)
featureFeat(comments): add Markdown support (server#54685)
featureFeat(files_sharing): provide web components based API for sidebar (server#54788)
featureFeat(ObjectStore): Add option to limit the total size (server#54797)
featureFeat(SystemTag): Add typed events for tag mapper events (server#54810)
featureFeat(migration-attributes): add DataCleansing (server#54842)
featureFeat(migration-attributes): missing attributes (server#54846)
featureAdd task processing manager method to get the list of available task type IDs (server#54848)
security[master] fix(security): Update CA certificate bundle (server#54992)
security[master] fix(security): Update code signing revocation list (server#55056)
security[master] fix(security): Update code signing revocation list (server#55446)
deprecatedPort away from deprecated Doctrine APIs (server#55674)
breakingChore!(files_sharing): remove deprecated `OCA.Sharing.ExternalLinkActions` (server#55718)
breakingRemove stable30 from dependabot (server#56018)
security[master] fix(security): Update CA certificate bundle (server#56211)
security[master] fix(security): Update code signing revocation list (server#56363)
breakingDebt(files): Remove regular stats request (server#56792)
security[master] fix(security): Update CA certificate bundle (server#56811)
security[master] fix(security): Update code signing revocation list (server#57031)
breakingEnhancement(files): remove redundant success toast on file rename (server#57168)
security[master] fix(security): Update code signing revocation list (server#57262)
breakingRefactor!: migrate files sidebar to Node API (server#57277)
security[master] fix(security): Update code signing revocation list (server#57380)
securityFix(security): Update Expires time (server#57688)
securityFix(security): Update code signing revocation list (server#57948)
deprecatedCleanup unused code and deprecated imports (text#7752)
+2364 more items in the release notessecurityFixes CVE-2026-45281: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL…
securityFixes CVE-2026-45282: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments…
securityFixes CVE-2026-45285: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includ…
securityFixes CVE-2026-45690: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed at…
securityFixes CVE-2026-45691: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successfu…
securityFixes CVE-2026-45279: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory conf…
securityFixes CVE-2026-45810: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authentica…
securityFixes CVE-2025-66512: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the cont…
securityFixes CVE-2026-45283: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the…
securityFixes CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 2…
securityFixes CVE-2025-66510: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, cont…